H.R. 3101 — what changed

changed develop and implement a maritime cybersecurity risk assessment model within 120 days after the date of the enactment of this Act, consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any update to that document pursuant to Public Law 113–274, to evaluate current and future cybersecurity risks (as that such term is defined in section 227 of the Homeland Security Act of 2002 (6 U.S.C. 148));

changed evaluate, on a periodic basis but not less often than once every two 2 years, the effectiveness of the maritime cybersecurity risk assessment model established under paragraph (1);

changed seek to ensure participation of at least one information sharing and analysis organization (as that such term is defined in section 212 of the Homeland Security Act of 2002 (6 U.S.C. 131)) representing the maritime community in the National Cybersecurity and Communications Integration Center, pursuant to subsection (d)(1)(B) of section 227 of the Homeland Security Act of 2002 (6 U.S.C. 148);such Act;

changed establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents (as such terms are defined in section 227 of the Homeland Security Act of 2002 (6 U.S.C. 148)) such Act) to the Center (as that such term is defined subsection (b) of such section 227 of the Homeland Security Act of 2002 (6 U.S.C. 148)), 227), and other appropriate Federal agencies; and

changed request the National Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to report and make recommendations to the Secretary on enhancing the sharing of information related to cybersecurity risks and incidents between relevant Federal agencies and State, local, and tribal governments and incidents, consistent with the responsibilities of the Center (as that term is defined subsection (b) of section 227 of the Homeland Security Act of 2002 (6 U.S.C. 148)); relevant public safety and emergency response agencies; Center, between relevant law enforcement and security organizations; maritime industry; port owners and operators; and terminal owners and operators.Federal agencies and—

changed that any area maritime transportation security plan and any vessel or facility security plan required under section 70103 of title 46, United States Code, approved after the development of the cybersecurity risk assessment model required by paragraph (1) of section 2 include a mitigation plan to prevent, manage, and respond to cybersecurity risks.risks (as such term is defined in section 227 of the Homeland Security Act of 2002 (6 U.S.C. 148)).